JWT weak HMAC secret
Summary: Burp Suite's scanner attempts to brute-force the HMAC secret behind every JWT it observes in traffic, working offline against a list of common weak secrets without sending requests to the server. When the secret can be cracked this way, an attacker can modify the token's header and payload and re-sign it with a valid signature, for example changing a "username": "joe" claim to "username": "admin" to escalate privileges or impersonate other users.
Key Takeaway: A single guessable HMAC secret means the signature that is supposed to guarantee a token's integrity offers no protection at all, and the privilege escalation happens with a token the server accepts as valid.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026